Checking access in Views

Question

I posted a support request on Drupal.org, but I thought I may find a faster answer here.

I am using the User Relationships module to create mutual relationships between two people with the purpose of viewing content. The node access part of UR seems to work fine. I am having trouble with Views, though.

Can anyone explain to me how I would do the following?

• Create a View containing content a user (not current logged in user) has created, filtered by a content type (lets call it Image). This view has a path with an argument like user/%/images.
• When the current user goes to user/%/images, it should show the images for whichever user ID is passed as the argument ONLY IF both users are related/accepted relationship. There is only one relationship type on the website. If there is no relationship, I would like to serve Access Denied, or at the very least, Page Not Found. But 403 makes more sense.

I cannot get this to work.

My goal is to show links to different types of contents users have created, and the viewing user (requester?) needs to have a relationship to view the content. Otherwise they should see nothing at all, or return an access denied error.

Answer 1

What you need is to create a custom views access plugin. I found a blog post that contains the basic information about how to do that here: http://techcp.wordpress.com/2011/01/11/adding-custom-access-plugin-to-views-in-drupal/

You then need at least need to do two specific things:

a) Extend it so that the access callback function receives the second url argument as the argument (in function get_access_callback(), change array() to array(1)).

b) In defined access callback function, check if there is a relationship between the currently logged in users and the uid that gets passed in, by using user_relationships_load() (documentation is for D7, but very similar in D6). Something like this (untested):

function your_access_callback($uid_viewed) {
  global $user;
  $params = array('between' => array($user->uid, $uid_viewed));
  return (bool) user_relationships_load($params, array('count' => TRUE));
}

That should already be enough to make it work four your case. However, this sounds like an interesting improvement to UR in general, for this, two additional things would be necessary.

c) Allow to configure which argument is the user id. Maybe there are also other ways where it could come from (if the view is displayed as a block for example). Not sure how to do that.

d) Allow to configure which relationship type should be checked. Expose a form element for that in the options and then pass the chosen relationship type id to your access callback and in there to user_relationships_load().

Answer 2

Using Views Access Callback together with the Privacy Per User module is supposed to work cleanly and easily.

Sample implementation:

function mymodule_views_access_callbacks() {
  return array(
    'mymodule_user_has_access' => t("Check user privacy policy "),
  );
}

// Callback function to determine if a view has access according to the user's privacy polocay.
function mymodule_check_user_privacy_policy($arg1 = NULL) {
  switch (arg(2)) {
    case 'blog':
      if (!privacypu_check_access($arg1,'post_blog_article'))
        return FALSE;
      break;
    case 'friends':
      if (!privacypu_check_access($arg1,'becomefriend'))
        return FALSE;
      break;
  }
  return user_access('access content');
}

The only issue is that with my Drupal 7 site the Views Access Callback module is having some kind of strange fatal error with my multi-display views, and the suggested patch doesn't work. Any idea on how to fix it?